Overview

overview

9

Static

static

8

f3ffb7492f...8d.exe

windows7_x64

9

f3ffb7492f...8d.exe

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f3ffb7492f6be60b4e3bff2cb9cb658d.exe

  • Size

    5.1MB

  • Sample

    210216-ptzb9xfdwx

  • MD5

    f3ffb7492f6be60b4e3bff2cb9cb658d

  • SHA1

    b4e6cb6f8429d70aac6fca37f86469d85a4d408a

  • SHA256

    c120fd3e62a0ecd299625f3fbf622fb8a56b534828b6788fe766f1bc36ac7a68

  • SHA512

    373bec9c21b7395ecd732e2c0de13fc051810139160c5b82ce3a6d7f58e75e5cd1a26e455ea032203a964d5056dfdcc450c462f8b6f4472c534b959e0b2bc105

Score
9/10
discoveryevasionspywarethemidatrojanvmprotect

Malware Config

Targets

    • Target

      f3ffb7492f6be60b4e3bff2cb9cb658d.exe

    • Size

      5.1MB

    • MD5

      f3ffb7492f6be60b4e3bff2cb9cb658d

    • SHA1

      b4e6cb6f8429d70aac6fca37f86469d85a4d408a

    • SHA256

      c120fd3e62a0ecd299625f3fbf622fb8a56b534828b6788fe766f1bc36ac7a68

    • SHA512

      373bec9c21b7395ecd732e2c0de13fc051810139160c5b82ce3a6d7f58e75e5cd1a26e455ea032203a964d5056dfdcc450c462f8b6f4472c534b959e0b2bc105

    Score
    9/10
    discoveryevasionspywarethemidatrojanvmprotect

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • themida

      Detects Themida, Advanced Windows software protection system.

      themida

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks